Ransom.Philadelphia (file analysis)

The Ransom.Philadelphia is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Philadelphia virus can do?

How to determine Ransom.Philadelphia?


File Info:
crc32: AAD202A9
md5: 9a26792ab5d15e465cf799752eebb579
name: 9A26792AB5D15E465CF799752EEBB579.mlw
sha1: 20556fec373b57ac94eec662b717131d61ed9e7d
sha256: 7a6112a937c72388f9bb9a1d5ef451869f233944c360ab391fe9df977fe86346
sha512: 35c093f5c0666f16fd65c4b02e118cd6d5e38ebfc8e0fb173151340fe87a890cb1d498f8b022bc54bad2dd7468f8000df920b9c14c4e0ae9a3416f30c559ca31
ssdeep: 12288:pCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfnlgsUtcnl+DDAu:pCdxte/80jYLT3U1jfyBclSb
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0809 0x04b0

Ransom.Philadelphia also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
DrWeb	Trojan.Siggen7.10497
MicroWorld-eScan	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C
FireEye	Generic.mg.9a26792ab5d15e46
CAT-QuickHeal	Trojan.AutoIt.Dropper.ZZ
McAfee	Artemis!9A26792AB5D1
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C
K7GW	Trojan ( 00502b0f1 )
K7AntiVirus	Trojan ( 00502b0f1 )
BitDefenderTheta	AI:Packer.F5FF277D17
Symantec	Ransom.Philadelphia
APEX	Malicious
Avast	FileRepMalware
ClamAV	Win.Ransomware.Philadelphia-7057772-0
Kaspersky	Trojan-Ransom.Win32.Agent.iza
NANO-Antivirus	Trojan.Win32.Autoit.fcryif
AegisLab	Trojan.Win32.Generic.4!e
Rising	Ransom.Agent!1.B5E9 (CLASSIC)
Ad-Aware	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C
Emsisoft	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C (B)
F-Secure	Heuristic.HEUR/AGEN.1139477
TrendMicro	Ransom_STAMPADO.SMAUIT
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
Sophos	Mal/Generic-S + Troj/PhilRns-A
Avira	HEUR/AGEN.1139477
MAX	malware (ai score=98)
Microsoft	Trojan:Win32/Predator!ml
Arcabit	Generic.Ransom.PhiladephiaB.E8AA513C
AhnLab-V3	Trojan/Win32.Agent.C3143594
ZoneAlarm	Trojan-Ransom.Win32.Agent.iza
GData	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C
Cynet	Malicious (score: 100)
ESET-NOD32	Win32/Filecoder.Philadelphia.E
Acronis	suspicious
ALYac	Dropped:Generic.Ransom.PhiladephiaB.E8AA513C
Malwarebytes	Ransom.Philadelphia
Panda	Trj/CI.A
TrendMicro-HouseCall	Ransom_STAMPADO.SMAUIT
Tencent	Win32.Trojan.Agent.Htby
Ikarus	Worm.Win32.Filecoder
eGambit	Unsafe.AI_Score_77%
Fortinet	AutoIt/Philadelphia.E!tr
AVG	FileRepMalware
Cybereason	malicious.ab5d15
Paloalto	generic.ml
Qihoo-360	Malware.Radar01.Gen

How to remove Ransom.Philadelphia?

Ransom.Philadelphia removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X